The world’s largest cryptocurrency exchange, Binance, is investigating a major security breach after approximately $6.3 billion in cryptocurrency was moved from wallets associated with the platform. The incident, which occurred on October 29, 2026, is being described by blockchain intelligence firm TRM Labs as the largest cryptocurrency theft recorded to date.
According to TRM Labs, approximately $6.36 billion in digital assets moved from Binance wallets across 10 blockchain networks. Most of the activity took place within roughly 20 minutes, beginning at around 20:05 UTC.
Binance has confirmed a security incident and said its initial investigation points to a potentially compromised laptop belonging to a DevOps engineer. The exchange has also said it found no evidence that wallet private keys were leaked.
The incident has triggered an international investigation, prompted emergency action from cryptocurrency companies and raised fresh concerns about the security of exchange infrastructure.
What Happened in the Binance Hack?
On October 29, cryptocurrency began moving from wallets associated with Binance to addresses controlled by an attacker.
TRM Labs tracked the transfers across networks including Ethereum, Bitcoin, Tron, the XRP Ledger, Solana, Arbitrum, Optimism, Base, Avalanche and Polygon.
The blockchain intelligence firm estimated that approximately $6.36 billion was transferred. It said the majority of the activity happened within a short period, although another wave of transfers involving Avalanche and Polygon wallets followed later.
The incident was not limited to a single cryptocurrency or blockchain. The movement of assets across multiple networks made the investigation more complex and required coordination between exchanges, blockchain intelligence companies, token issuers and law enforcement agencies.
Binance initially described the event as a potential security issue. Its subsequent statement provided an estimated impact of around $6.3 billion.
How Did the Attack Happen? Binance Points to a Compromised DevOps Laptop
Binance’s preliminary investigation suggests that the incident may have involved a compromised laptop belonging to a DevOps engineer.
According to the exchange, the attacker may have used access to the employee’s computer to reach a service container and submit unauthorised withdrawal transactions.
DevOps teams work with the systems and infrastructure used to develop, deploy and operate software. Access to these environments can be sensitive because they may connect to internal services and operational systems.
Binance has stated that it has found no evidence of a wallet private key leak. However, the company has not yet published its final technical investigation or confirmed the complete attack path.
TRM Labs’ independent blockchain analysis provides another important part of the picture. Its report indicates that the attacker used an EIP-7702 delegation involving a Binance Ethereum hot wallet. The firm also identified pre-signed authorisations prepared in advance.
Transfers from Binance wallets on other blockchain networks were made through ordinary signed transactions. Based on this activity, TRM assessed that the incident likely involved access to Binance’s hot-wallet signing infrastructure.
These findings are an independent blockchain intelligence assessment, not Binance’s final technical conclusion.
Around $3 Billion in Crypto Assets Frozen
One of the most significant developments has been the effort to stop affected cryptocurrency from moving further.
Binance said it had worked with blockchain partners to freeze approximately $3 billion in affected assets on-chain.
TRM Labs reported that roughly $2.7 billion had been frozen or moved out of the attacker’s reach in its October 30 tracking snapshot. This included action by several stablecoin issuers and the Arbitrum network.
Companies and organisations involved included:
- Tether: Froze approximately $1.77 billion in USDT linked to the incident, according to TRM Labs.
- Circle: Froze approximately $825 million in USDC.
- Ripple: Froze approximately $40.5 million in RLUSD.
- World Liberty Financial: Froze approximately $27.8 million in USD1.
- Arbitrum Security Council: Took emergency action involving 8,426 ETH and 74.6 million ARB.
The reported totals differ slightly because organisations and investigators use different tracking times and valuation snapshots.
It is also important to understand that freezing cryptocurrency is not the same as completing its recovery. A freeze can prevent certain assets from being transferred, but returning them to their rightful owners may require further coordination and legal processes.
TRM Labs said the attacker still controlled more than 420,000 ETH and 18,270 BTC, valued at approximately $2.4 billion in its October 30 snapshot. These assets are not directly subject to the same issuer-level freezing controls available for certain stablecoins.
Who Is Behind the Binance Hack?
Blockchain intelligence firms have linked the incident to TraderTraitor, a North Korean state-sponsored hacking group.
TRM Labs attributed the attack to the group with high confidence, citing similarities with previous North Korea-linked cryptocurrency thefts. Chainalysis also assessed that TraderTraitor was likely responsible.
The attribution is significant because the same group was linked by the FBI to the February 2025 Bybit hack, in which approximately $1.5 billion in cryptocurrency was stolen.
However, Binance has not independently confirmed the identity of the attackers. The exchange has said it is working with law enforcement partners to establish who was responsible.
The North Korea connection should therefore be understood as an assessment by blockchain intelligence firms, rather than a final public law-enforcement finding in this case.
Binance Says It Will Cover All Losses
Following the incident, Binance said customer funds were safe and that it would cover all losses using its Secure Asset Fund for Users (SAFU) and company funds.
The exchange also announced several immediate security measures:
- Revoking authorisation associated with the affected address.
- Working with law enforcement and blockchain intelligence partners.
- Tracing affected cryptocurrency and coordinating further freezes.
- Reviewing its withdrawal infrastructure and related security controls.
- Planning to publish a detailed technical post-mortem after the investigation is complete.
Binance also said it would publish an updated Proof of Reserves after the remediation work is completed.
In a later update on October 30, the exchange said deposits remained operational, while withdrawals were still paused as its team carried out additional security checks. Binance said it expected withdrawal services to resume within 48 hours.
These service updates may change as the investigation progresses. Users should check Binance’s official announcements for the latest information.
Crypto Markets React to the Security Incident
The Binance incident also affected cryptocurrency market sentiment.
Reuters reported that Bitcoin fell to a six-week low of $77,646, while Ethereum reached a two-month low of $2,238.76. BNB, the token associated with the Binance ecosystem, fell by more than 8% to around $694 in the reported market snapshot.
These figures reflect prices reported at a particular point on October 30, 2026. Cryptocurrency prices can change rapidly, so they should not be treated as current live prices.
The incident has renewed questions about the risks associated with holding digital assets on centralised cryptocurrency exchanges.
What the Binance Hack Means for Crypto Security
The incident highlights an important cybersecurity issue: protecting cryptocurrency wallets is not only about securing private keys.
Exchange infrastructure also depends on employee devices, internal services, access permissions, transaction approval systems and the software used to manage wallet operations.
A compromised device or internal service can create serious risks when it has access to sensitive operational systems.
For cryptocurrency exchanges, some of the key security priorities highlighted by this incident include stronger endpoint protection, restricted privileged access, independent transaction approvals, secure signing infrastructure and continuous monitoring of unusual wallet activity.
The investigation also demonstrates the importance of cooperation between exchanges, blockchain analytics firms, stablecoin issuers and law enforcement agencies. Their coordinated response helped freeze or secure a substantial amount of the affected assets.
What Happens Next?
The investigation is still developing. Binance has not yet released its full technical post-mortem, and the complete attack path has not been publicly established.
Investigators and blockchain intelligence firms will continue tracking the affected wallets and monitoring whether the remaining assets move through exchanges, lending platforms or other blockchain services.
The next important developments will be the restoration of withdrawal services, further information about the compromised infrastructure, updates on the frozen assets and any official findings about the attackers.
The Binance incident is a major reminder that even large cryptocurrency platforms face risks from weaknesses in their internal systems. The final investigation will be important for understanding how the breach happened and what security changes may be needed across the wider cryptocurrency industry.
Frequently Asked Questions
How much cryptocurrency was affected by the Binance hack?
Binance estimated the total impact at approximately $6.3 billion. TRM Labs traced approximately $6.36 billion in transfers from Binance wallets across 10 blockchain networks.
When did the Binance security breach happen?
The main activity occurred on October 29, 2026. TRM Labs reported that most of the transfers took place within roughly 20 minutes, beginning around 20:05 UTC.
How much cryptocurrency has been frozen?
Binance reported that approximately $3 billion in affected assets had been frozen on-chain. TRM Labs estimated roughly $2.7 billion had been frozen or moved out of the attacker’s reach in its October 30 snapshot.
Who is suspected of carrying out the Binance hack?
TRM Labs attributed the incident to TraderTraitor, a North Korean state-sponsored hacking group. Chainalysis also assessed that the group was likely responsible. Binance has not publicly confirmed the attackers’ identity.
Are Binance customer funds safe after the hack?
Binance has stated that customer funds are safe and that it will cover all losses through its SAFU fund and company funds. The exchange’s investigation and technical review are ongoing.